syslog-ng 系列连载-38 ：处理大量的并行连接

7.1. Handling lots of parallel connections

When syslog-ng is receiving messages from a large number of TCP or unix-stream connections, the CPU usage of syslog-ng might increase even if the number of messages is low. By default, syslog-ng processes every message when it is received. To reduce the CPU usage, process the incoming messages in batches. To accomplish this, instruct syslog-ng to wait for a short time before processing a message. During this period additional messages might arrive that can be processed together with the original message. To process log messages in batches, set the time_sleep() option (measured in milliseconds) to a non-zero value. Include the following line in your syslog-ng configuration:

# 注释 ：syslog-ng 由于采用 TCP 连接，所以很容易造成 CPU 负载的上升。默认情况下，syslog-ng 处理它所收到的每个消息。要减少 CPU 利用率，可以通过批处理的方式来降低 CPU 利用率。

# 要实现该目的，可以告诉 syslog-ng 在处理每个消息之前先等待一段时间，然后一次处理多个消息。这是通过 time_sleep （n）选项实现的，单位是毫秒。

	            
options { time_sleep(20); };	            
		

	Note
	It is not recommended to increase the time_sleep() parameter above 100ms, as that might distort timestamps, slow down syslog-ng, and cause messages to be dropped. When modifying the time_sleep() option, also adjust the log_fetch_limit() and log_fifo_size() options accordingly. # 注释 ：注意，并不建议该值大于 100 ，因为这可能会影响到消息的时间戳的准确性，导致消息被丢弃。 # 建议在调整 time_sleep （）的同时也调整 log_fetch_limit（）和 log_fifo_size（）

The max_connections() parameter limits the number of parallel connections for the source.

# 注释 ：还有 max_connection（）可以限制并发的最大连接数目

If adjusting the time_sleep() option is not desired for some reason, an alternative solution is to use unix-stream(), udp() and unix-dgram() sources instead of tcp() connections.

# 注释 ：你还可以通过使用 UDP、socket 类的连接来代替 tcp 连接

---